New virus is no April Fools' joke, FBI says

APRIL 3The FBI over the weekend warned that a newly discovered Internet worm can jump from computer to computer more quickly than previous forms.

The 911 worm is so called because it causes infected computers' modems to dial 911, potentially disrupting local emergency lines. It also deletes the contents of hard drives.

The FBI's National Infrastructure Protection Center has posted a warning at www.nipc.gov/nipc/advis00-038.htm. The warning says the worm searches the Internet for systems that allow file and print sharing and then copies itself onto them.

The worm appeared first in the Houston area. Initial reports suggested that it had only limited distribution, but it has now been discovered in San Francisco, said Alan Paller, research director at the SANS Institute of Bethesda, Md.

"There are no walls in the Internet," said a virus warning sent out by the SANS Institute over the weekendthe first such warning issued in four years, Paller said.

Network Associates Inc. of Santa Clara, Calif., publisher of the McAfee line of antivirus software, has assessed the risk of the 911 worm as low. Network Associates' virus alert appears at vil.nai.com/vil/wm98557.asp. Other security sources, however, said the 911 worm is potentially dangerous because it can spread over open networks and requires little action by users. The Melissa virus last year spread through the opening of e-mail messages by Microsoft Windows users [see story at www.gcn.com/archives/gcn/1999/April5/1.htm].

Paller said the 911 worm is propagating because many users have set their machines to allow file sharing. "Once you do that, when you connect to the Internet everything is shared," Paller said. He suggested that organizations turn off file sharing, at least for a time, to stop the spread. Users can then go back and turn on file sharing for individual items, he said.